Data Processing Addendum

1. Definitions

“Customer Data” has the meaning given in the Terms of Service: all data that Customer or its Authorized Users submit to, generate within, or upload to the Service.

“Personal Information” means any Customer Data that identifies or can reasonably be linked to an identifiable individual, such as an employee, a shop customer, or a vehicle owner.

“Security Incident” means a breach of BayBoard’s security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information in BayBoard’s possession, custody, or control. Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Information, including unsuccessful log-in attempts, pings, port scans, denial-of-service attacks, or other network attacks on firewalls or networked systems.

“Subprocessor” means a third-party vendor BayBoard uses that processes Personal Information in the course of providing the Service.

2. Roles and Scope of Processing

Customer decides what data goes into its BayBoard account and how it is used; BayBoard processes that Customer Data only on Customer’s behalf, as Customer’s service provider and processor, and only to provide, secure, support, and improve the Service as described in the Terms of Service. Customer’s instructions to BayBoard are the Terms of Service, this DPA, and Customer’s configuration and use of the Service. BayBoard will not process Personal Information for any other purpose, and will never sell it.

BayBoard may use Aggregated Data (as defined in the Terms of Service) solely to internally improve the Service and to produce de-identified internal statistics. BayBoard does not publish industry reports from Aggregated Data, does not name Customer, any Authorized User, any individual, or any specific shop in those statistics, and does not sell Aggregated Data. That use is not a sale of Personal Information.

The processing covered by this DPA is:

• Categories of individuals: the shop’s own staff (owners, service advisors, foremen, and technicians), and the shop’s own customers, the vehicle owners whose cars the shop services.
• Categories of data: for shop staff, display name, email address, role and membership status, invite email, work schedules, hours, time off, and technician skill notes; for the shop’s end customers, first and last name, phone number (held in a role-restricted lookup that Technician accounts cannot read), vehicle information (year, make, model, VIN, and license plate), repair orders, job history, and related notes.
• Purpose and duration: operating the scheduling and bay management service for Customer, for the life of Customer’s subscription plus the wind-down period in Section 7.

3. Confidentiality

BayBoard limits access to Personal Information to personnel and Subprocessors who need it to provide the Service and who are bound by confidentiality obligations. BayBoard will not disclose Personal Information to any third party except as described in this DPA, in the Privacy Policy, or as required by law. If a law enforcement or government request seeks Customer Data, BayBoard will notify Customer before disclosing unless legally prohibited from doing so.

4. Security Measures

BayBoard maintains commercially reasonable administrative, technical, and physical safeguards designed to protect Personal Information, including:

• Encryption in transit (TLS) for all connections to the Service.
• Encryption at rest provided by our cloud database and storage providers.
• Multi-tenant isolation enforced by server-side security rules that scope every data access to the Customer’s own shop.
• Role-based access control within the Service and least-privilege access for BayBoard personnel.
• Error monitoring and operational logging.

Our Security page describes these practices in more detail. BayBoard may improve its safeguards over time and will not materially reduce the overall protection of Personal Information during a Subscription Term.

5. Subprocessors

Customer authorizes BayBoard to use Subprocessors to provide the Service. The current list, including each vendor’s purpose and processing region, is published at bayboard.io/subprocessors.

• BayBoard updates that page before a new Subprocessor begins processing Personal Information.
• Customer can receive email notice of Subprocessor changes by requesting it at hello@bayboard.io.
• If Customer reasonably objects to a new Subprocessor on data protection grounds within 30 days of the page update or notice, the parties will discuss the concern in good faith. If BayBoard cannot reasonably accommodate the objection, Customer may cancel its subscription as described in the Terms of Service.
• BayBoard requires each Subprocessor to protect Personal Information to a standard consistent with this DPA, and BayBoard remains responsible to Customer for its Subprocessors’ performance.

6. Security Incident Notification

If BayBoard becomes aware of a Security Incident affecting Customer’s Personal Information, BayBoard will notify Customer without undue delay after BayBoard becomes aware, and in any event no later than 72 hours after BayBoard becomes aware. The notice will describe, to the extent known, the nature of the incident, the categories of data and individuals affected, the measures taken or planned in response, and a contact point for follow-up. BayBoard will keep Customer reasonably informed as the investigation develops and will provide the information Customer reasonably needs to meet its own notification obligations to its employees, end customers, or regulators.

BayBoard’s notification of a Security Incident is not an admission of fault or liability.

7. Retention, Return, and Deletion

BayBoard retains Customer Data for the life of Customer’s subscription. When the subscription ends, for any reason:

• Customer Data remains available for export for 90 days after the end of the subscription. Customer can request an export at hello@bayboard.io.
• 90 days after the end of the subscription, BayBoard deletes Customer Data, except where retention is required by law or for limited business records such as billing history, fraud prevention, or dispute resolution.
• Residual copies may persist in routine backups until those backups roll off in the ordinary course, and remain protected by this DPA until deleted.
• On request, BayBoard will confirm deletion in writing.

8. Assistance with Individual Requests

If someone contacts BayBoard directly about their personal information, for example one of the shop’s employees or one of the shop’s own customers, we will point them back to their shop rather than handling the request ourselves, unless the law requires otherwise. BayBoard will provide reasonable assistance, at Customer’s request, so Customer can respond to access, correction, deletion, and export requests using the tools in the Service or with BayBoard’s help.

9. Demonstration of Compliance

On Customer’s written request, no more than once per year, BayBoard will provide a written summary of its security practices and answer Customer’s reasonable questions about its processing of Personal Information under this DPA. This is the agreed means of demonstrating compliance; this DPA does not grant on-site audit rights.

10. Restrictions on BayBoard’s Use of Personal Information

BayBoard does not sell Personal Information, does not share it for cross-context behavioral advertising, does not retain, use, or disclose it outside the direct business relationship with Customer, and processes it only for the business purposes described in Section 2. These restrictions are contractual promises to Customer and apply regardless of where Customer operates. BayBoard’s use of Aggregated Data solely to internally improve the Service and to produce de-identified internal statistics, as described in Section 2, is not a sale of Personal Information.

For purposes of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, “CCPA/CPRA”), the Colorado Privacy Act (“CPA”), and other applicable U.S. state privacy laws, BayBoard is a service provider / processor, not a controller or third party, with respect to Personal Information in Customer Data. Individual requests and, where applicable, appeals — a second look by BayBoard, and then, for Colorado residents, the Colorado Attorney General — are handled as described in the Privacy Policy and Section 8 of this DPA: shop-floor data goes to the shop first; BayBoard will assist.

11. Restricted Data

Customer represents and warrants to BayBoard that Customer Data does not and will not contain any social security numbers or other government-issued identification numbers, protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; health insurance information; biometric information; passwords or other credentials for third-party online accounts (other than credentials created for and used solely to access the Service); credentials to any financial accounts; tax return data; any payment card information subject to the Payment Card Industry Data Security Standard; personal data of children under 16 years of age; or any other information that falls within any special categories of data (as defined in applicable data protection laws) (“Restricted Data”).

BayBoard does not offer a business associate agreement and is not a HIPAA business associate. The Service is not designed to process Restricted Data.

12. General

• This DPA takes effect when Customer accepts the Terms of Service and remains in effect as long as BayBoard processes Personal Information on Customer’s behalf, including the wind-down period in Section 7.
• For the subject matter of data processing, this DPA controls over the Terms of Service; for everything else, the Terms of Service control.
• This DPA is subject to the limitations of liability in the Terms of Service.
• This DPA is governed by the laws of the State of Colorado, the same as the Terms of Service.

13. Contact

Questions about this DPA go to:

BayBoard LLC
Jessen Perko
3773 E Cherry Creek North Dr
Denver, CO 80209
303-398-7088
Email: hello@bayboard.io

Operational questions go to hello@bayboard.io. Formal legal and privacy mail may be sent to the Jessen mailing address above.